CRITICALCVSS 9.8EPSS 11.1%

CVE-2023-22884

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Published: 2023-01-21
Modified: 2026-10-27
EPSS percentile: 96%
Aliases: GHSA-c732-xvv8-g94c
Sources: github-advisory

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	apache-airflow	—	2.5.1
PyPI	apache-airflow-providers-mysql	—	4.0.0

Remediation: Upgrade to 2.5.1 or later.

References

https://github.com/advisories/GHSA-c732-xvv8-g94c

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.